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MEMORANDUM  FOR  DIRECTOR,  DEFENSE  FINANCE  AND  ACCOUNTING 

SERVICE 

SUBJECT:  Audit  Report  on  Defense  Military  Pay  Year  2000  End-to-End  Testing 
(Report  No.  00-017) 


We  are  providing  this  report  for  information  and  use.  This  is  one  in  a  series  of 
reports  that  the  Inspector  General,  DoD,  is  issuing  in  accordance  with  an  informal 
partnership  with  the  DoD  Chief  Information  Officer  to  monitor  Defense  Finance  and 
Accounting  Service  efforts  to  address  the  Year  2000  computing  challenge.  We 
considered  management  comments  on  a  draft  of  this  report  when  preparing  the  final 
report.  Management  comments  met  the  requirements  of  DoD  Directive  7650.3. 

We  appreciate  the  courtesies  extended  to  the  audit  staff.  For  additional 
information  on  this  report,  please  contact  Ms.  Kimberley  A.  Caprio  at  (703)  604-9139 
(DSN  664-9139)  (kcaprio@dodig.osd.mil),  Mr.  Dennis  L.  Conway  at  (703)  604-9158 
(DSN  664-9158)  (dconway@dodig.osd.mil),  or  Mr.  Eric  L.  Lewis  at  (703)  604-9144 
(DSN  664-9144)  (elewis@dodig.osd.mil).  See  Appendix  E  for  the  report  distribution. 
See  the  inside  back  cover  for  a  list  of  audit  team  members. 

David  K.  Steensma 
Deputy  Assistant  Inspector  General 
for  Auditing 
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Report  No.  00-017  October  21, 1999 

(Project  No.  9FG-9026) 

Defense  Military  Pay  Year  2000  End-to-End  Testing 
Executive  Summary 


Introduction.  This  is  one  in  a  series  of  reports  that  the  Inspector  General,  DoD,  is 
issuing  in  accordance  with  an  informal  partnership  with  the  DoD  Chief  Information 
Officer  to  monitor  DoD  efforts  to  address  the  Year  2000  (Y2K)  computer  challenge. 

For  a  list  of  audit  projects  addressing  the  issue,  see  the  Y2K  website  on  the  IGnet  at 
http://www.ignet.gov. 

The  purpose  of  end-to-end  testing  is  to  verify  that  the  interrelated  systems  supporting  an 
organizational  function,  such  as  military  pay  and  retirement  and  annuitant  pay,  interact 
as  intended  in  an  operational  environment.  For  purposes  of  conducting  end-to-end 
assessments,  the  Defense  Finance  and  Accounting  Service  identified  seven  critical 
business  processes  referred  to  as  events.  Military  pay  was  identified  as  one  of  the 
seven  events.  The  military  pay  mission  is  to  process  military  and  retiree  payroll  and  to 
make  annuity  payments  resulting  from  notification  of  death.  Between  May  and  October 
1999,  the  Defense  Finance  and  Accounting  Service  will  conduct  end-to-end  testing  of 
the  systems  that  pay  active-duty  military,  retirees,  and  annuitants. 

Objective.  The  overall  audit  objective  was  to  evaluate  the  plans  for  end-to-end  testing 
of  DoD  military  pay  and  retirement  and  annuitant  pay.  Specifically,  we  reviewed  the 
Defense  Finance  and  Accounting  Service  Y2K  End-to-End  Master  Test  Plan  and  the 
plans  for  conducting  end-to-end  testing  of  military  pay  and  retirement  and  annuitant 
pay. 

Results.  The  Defense  Finance  and  Accounting  Service  plans  for  conducting  military 
pay  end-to-end  testing  were  not  in  accordance  with  the  Defense  Finance  and 
Accounting  Service  Y2K  End-to-End  Master  Plan,  which  would  have  provided  a  sound 
approach  with  maximum  risk  mitigation,  in  several  key  areas.  Specifically,  the 
end-to-end  test  plans: 

•  did  not  provide  for  testing  all  critical  dates; 

•  provided  for  testing  in  a  simulated  environment  without  an  analysis  of  the  risks 
involved; 

•  did  not  require  baselines  as  stated  in  the  Master  Plan  (the  baseline  is  the  set  of 
known  end-to-end  test  inputs  and  outputs  extracted  from  systems  that  have 
been  certified  as  Y2K  compliant); 


•  did  not  include  a  standard  methodology  for  tracking  the  tests;  and 

•  did  not  provide  for  a  risk  assessment  and  management  program. 

As  a  result,  the  test  results  alone  may  not  provide  sufficient  assurance  that  Y2K 
disruptions  will  not  occur. 

Summary  of  Recommendations.  Because  end-to-end  testing  is  substantially  complete, 
we  recommend  that  the  Director,  Defense  Finance  and  Accounting  Service,  take 
alternative  measures  to  mitigate  the  risk  that  military  pay  systems  will  be  unable  to 
successfully  process  data  after  2000.  Such  alternatives  may  include  performing 
supplementary  end-to-end  tests,  using  code  scanners,  or  expanding  the  contingency 
plans. 

Management  Comments.  The  Defense  Finance  and  Accounting  Service,  Director, 
Information  Technology,  concurred  with  the  recommendations  and  stated  that: 

•  DFAS  has  hired  the  Joint  Interoperability  Test  Command  to  independently 
review,  validate,  and  assist  in  documenting  the  end-to-end  testing  of  systems. 

•  Additional  contingency  plans  have  been  drafted,  and  contingency  testing 
beyond  the  minimum  requirements  will  be  conducted. 

•  An  independent  contractor  has  performed  code  scanning  of  the  Defense  Joint 
Military  Pay  System,  and  the  other  military  pay  systems  will  be  scanned 
before  November  30,  1999. 

Refer  to  the  Finding  for  a  discussion  of  management  comments  and  to  the  Management 
Comments  section  for  the  complete  text  of  the  comments. 
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Background 


Addressing  the  Year  2000  Computing  Challenge.  This  is  one  in  a  series  of 
reports  being  issued  by  the  Inspector  General,  DoD,  in  accordance  with  an 
informal  partnership  with  the  Chief  Information  Officer,  DoD,  to  monitor 
efforts  to  address  the  Year  2000  (Y2K)  computing  challenge.  For  a  list  of  audit 
projects  on  this  issue,  see  the  Y2K  website  at  www.ignet.gov. 

The  Defense  Finance  and  Accounting  Service  (DFAS)  is  the  principal  agency 
responsible  for  DoD  accounting.  In  FY  1998,  DFAS  processed  a  monthly 
average  of  9.8  million  payments  to  DoD  personnel,  1.2  million  commercial 
invoices,  600,000  travel  vouchers  or  settlements,  500,000  savings  bonds,  and 
120,000  transportation  bills  of  lading.  The  agency’s  monthly  disbursements 
totaled  approximately  $24  billion. 

For  Y2K  purposes,  DFAS  has  identified  451  systems  as  mission-critical.  To  test 
mission-critical  systems  for  Y2K  compliance,  DFAS  has  identified  its  critical 
business  processes  and  has  developed  plans  to  test  those  processes.  Critical 
processes  are  those  that,  if  not  performed,  would  prevent  or  immediately  impair 
disbursal,  pay,  and  accounting.  Specifically,  DFAS  identified  the  following 
seven  critical  business  processes:  civilian  pay,  military  pay  (including 
retirement  and  annuitant  pay),  contractor  and  vendor  pay,  transportation  pay, 
travel  pay,  accounting,  and  disbursing.2 

End-to-End  Testing.  The  end-to-end  process  is  the  flow  of  data  through  a  set 
of  interconnected  systems  that  performs  a  core  business  process,  function,  or 
mission.  Data  flow  begins  with  the  initial  input  of  data  into  the  first  system  and 
ends  with  the  final  receipt  of  data  in  the  last  system  and  the  receipt  of  output  by 
the  user.  The  purpose  of  Y2K  end-to-end  testing  is  to  verify  that  the  set  of 
interrelated  systems  supporting  DFAS  business  processes,  such  as  DoD  military 
pay,  operate  and  appropriately  process  Y2K-related  data. 

DFAS  End-to-End  Testing.  DFAS  has  organized  its  end-to-end  testing  into 
seven  testing  events,  one  for  each  critical  mission  or  business  process.  DFAS 
has  further  divided  each  event  or  business  process  into  threads.  A  thread  is  a 
system  or  set  of  systems  that  perform  the  functions  within  the  business  process. 
Each  event  can  contain  one  or  more  threads. 

DoD  Y2K  Management  Plan.  The  “DoD  Y2K  Management  Plan,” 
version  2.0,  December  1998,  defines  the  DoD  Y2K  management  strategy, 
including  the  planning  and  execution  of  end-to-end  testing.  Appendix  I  of  the 
management  plan,  “Guidelines  to  Support  DoD  Y2K  Operational  Readiness,” 
provides  guidance  on  planning,  executing,  and  evaluating  activities  required  to 


1  In  previous  audit  reports,  we  identified  42  DFAS  mission-critical  systems.  DFAS  recently  added  three 
systems  to  its  mission-critical  list:  the  Standard  Accounting  and  Reporting  System-One  Pay,  the 
Standard  Army  Financial  Accounting  and  Reporting  System,  and  the  Standard  Base  Supply  System. 

2  A  disbursing  system  makes  payments  based  on  a  pay  system’s  calculations. 
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assess  Y2K  readiness.  These  activities  include  end-to-end  tests  of  functional 
areas.  Appendix  I  identifies  roles  and  responsibilities  and  defines  the 
requirements  for  developing  end-to-end  master  plans,  event  plans,  reporting, 
risk  assessment,  data  collection  and  data  analysis,  execution,  and  management 
controls. 

DFAS  Y2K  End-to-End  Testing  Guidance.  DFAS  issued  the  “DFAS 
Year  2000  Management  Plan  (the  Management  Plan),”  version  2.0,  in 
May  1999.  The  Management  Plan  provides  guidance  for  the  entire  Y2K 
process,  including  testing,  to  ensure  the  continuation  of  DFAS  operations 
through  January  2000  and  beyond.  For  purposes  of  testing,  the  Management 
Plan  identifies  requirements  that  include  the  following: 

•  use  of  the  test  procedures  and  processes  defined  in  DFAS 
Regulation  8000. 1-R,  “Information  Management  Policy  and 
Instructional  Guidance,”  August  21,  1996; 

•  mandatory  completion,  signing,  and  approval  of  Y2K  checklists  for 
certifying  systems  as  Y2K  compliant;  and 

•  documented  proof  of  Y2K  compliance  from  systems  of  which  DFAS 
is  a  minority  owner. 

DFAS  Y2K  End-to-End  Master  Plan.  DFAS  issued  the  “DFAS  Y2K 
End-to-End  Master  Plan  (the  Master  Plan),”  version  2.2,  June  1,  1999, 
specifically  for  Y2K  end-to-end  testing  of  its  mission-critical  business  processes. 
The  Master  Plan  identifies  roles  and  responsibilities;  assumptions  and 
constraints  related  to  testing;  interfaces  with  non-DFAS  organizations;  and  the 
requirements  for  planning,  testing,  and  reporting  on  test  results. 

Roles  and  Responsibilities.  DFAS  designated  a  Y2K  project 
manager  and  a  military  pay  functional  proponent  at  DFAS  headquarters  who 
have  overall  Y2K  testing  responsibility.  DFAS  directed  its  functional 
proponents  to  assign  event  leaders  and  thread  leaders  to  execute  the  end-to-end 
testing.  DFAS  has  also  assigned  roles  and  responsibilities  to  system  managers 
for  controlling  their  segments  of  the  end-to-end  testing  process. 

Assumptions  and  Constraints.  Because  of  limited  time  and 
resources,  the  Master  Plan  acknowledged  constraints  and  identified  assumptions 
related  to  Y2K  end-to-end  testing.  These  included  the  assumptions  that  third- 
party  software  and  computing  platforms  are  Y2K  compliant;  that  operations  and 
compliance  testing  takes  precedence  over  end-to-end  testing;  that  partner 
organizations  will  conduct  their  own  internal  end-to-end  tests  and  provide  input 
for  DFAS;  and  that  all  mission-critical  systems  will  have  contingency  plans  in 
place. 


Interface  Requirements.  The  Master  Plan  stated  that  each  test 
event  will  include  critical  automated  interfaces  with  other  departments  and 
agencies.  However,  because  of  size  limitations  at  the  DISA  Megacenters  that 
support  testing,  DFAS  and  the  other  DoD  organizations  may  not  be  able  to  run 
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true  end-to-end  tests  simultaneously.  Rather,  each  organization  will  maintain 
sufficient  control  of  its  segment  of  the  end-to-end  testing  process  to  ensure  the 
integrity  of  the  data  flow  from  one  system  to  another. 

Planning,  Testing,  and  Reporting.  The  Master  Plan  included  the  following: 

•  Live  Versus  Simulation  Testing.  DFAS  plans  to  test  its  business 
processes  under  normal  operating  conditions  when  possible. 
Otherwise,  DFAS  will  use  a  time  machine  or  simulated  operating 
environment  and  will  document  the  reasons  and  the  associated  risks 3 

•  Critical  Dates.  Although  the  Master  Plan  did  not  designate  specific 
dates  for  testing,  it  recommended  that  testing  cover  the  following  five 
periods:  the  fiscal  Y2K  crossover,  calendar  year  2000  crossover, 
fiscal  year  2001  crossover,  calendar  year  2001  crossover,  and  leap 
year  (February  29,  2000).  DFAS  recommended  that  the  dates 
chosen  for  testing  be  consistent  with  the  dates  tested  by  interfacing 
systems. 

•  Baselines.  The  Master  Plan  stated  that  after  testing  the  dates,  DFAS 
organizations  would  compare  their  test  results  to  outcomes  previously 
determined  as  the  baseline.  (The  baseline  is  the  set  of  known 
end-to-end  test  inputs  and  outputs  extracted  from  systems  that  have 
been  certified  as  Y2K  compliant.)  Each  DFAS  organization  will 
document  the  discrepancies  between  each  of  the  tests  and  the 
baseline. 

•  Data  Analysis  and  Documentation.  The  Master  Plan  required  that 
each  DFAS  organization  develop  and  document  in  its  test  plan  a  data 
collection  and  analysis  strategy  with  sufficient  information  to  support 
end-to-end  test  design,  results,  and  analysis.  The  Master  Plan  left 
the  details  of  data  analysis  or  documentation  to  the  organizations 
responsible  for  testing. 

Military  Pay  Event.  DFAS  identified  military  pay  as  one  of  the  seven  critical 
business  processes.  The  military  pay  mission  is  to  process  military  and  retiree 
payroll  and  make  annuity  payments  resulting  from  notification  of  death. 
End-to-end  testing  of  military  pay  systems  is  scheduled  to  take  place  between 
May  and  August  1999. 

High-Impact  Federal  Program.  On  March  26,  1999,  the  Director,  Office  of 
Management  and  Budget  (OMB),  issued  memorandum  M-99-12,  “Assuring  the 
Year  2000  Readiness  of  High-Impact  Federal  Programs,”  to  the  heads  of  the 
Executive  departments  and  agencies.  The  memorandum  identified  42  Federal 


3Time-machine  tests  involve  setting  system  clocks  to  the  year  2000  and  operating  under  test  conditions. 
A  simulation  is  a  program  that  allows  testers  to  simulate  changing  dates  on  files  rather  than  actually 
changing  the  system  dates.  Consequently,  a  simulation  does  not  test  the  transition  to  a  Y2K  date. 
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programs  that  are  high-impact  in  terms  of  delivery  of  services  to  the  public  and 
assigned  a  lead  agency  for  each  program.  Military  retirement  was  listed  as  a 
high-impact  program,  and  DoD  was  designated  as  the  lead  agency  for  the 
program.  Lead  agencies  are  required  to  provide  additional  details  on  Y2K 
readiness  of  high-impact  programs  in  quarterly  reports  to  OMB.  The  computer 
system  used  to  process  pay  for  retired  military  personnel  is  the  Defense 
Retirement  and  Annuitant  System  (DRAS),  which  is  owned  by  DFAS. 

Objectives 


The  overall  audit  objective  was  to  evaluate  the  effectiveness  of  the  planned 
end-to-end  testing  of  DoD  military  pay  and  retirement  and  annuitant  pay. 
Specifically,  we  reviewed  the  Master  Plan  and  plans  for  conducting  end-to-end 
testing  of  military  pay  and  retirement  and  annuitant  pay. 

This  report  addresses  plans  for  conducting  Y2K  end-to-end  testing  for  DoD 
military  pay  and  retirement  and  annuitant  pay  systems.  Future  reports  will 
address  other  critical  business  processes  at  DFAS.  See  Appendix  A  for  a 
discussion  of  the  audit  scope  and  methodology  and  the  management  control 
program  and  for  information  on  prior  audit  coverage. 
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Plans  for  End-to-End  Testing  of  Military 
Pay  Systems 

Military  pay  system  managers  at  DFAS  took  the  initiative  of  developing 
plans  for  end-to-end  testing  before  the  DFAS  Y2K  Master  Plan  was 
issued.  The  plans  were  based  on  sound  methodologies  and  presented  a 
detailed  outline.  However,  DFAS  plans  for  the  end-to-end  testing  of  the 
military  pay  functional  area  did  not  provide  sufficient  evidence  to  ensure 
that  data  would  be  appropriately  processed  and  that  payments  to  active- 
duty  military,  retirees,  and  annuitants  would  continue  unaffected  by  Y2K 
problems.  The  end-to-end  test  plans: 

•  did  not  provide  for  testing  all  critical  dates; 

•  provided  for  testing  in  a  simulated  environment  without  an 
analysis  of  the  risks  involved; 

•  did  not  require  baselines  as  stated  in  the  Master  Plan  (the 
baseline  is  the  set  of  known  end-to-end  test  inputs  and  outputs 
extracted  from  systems  that  have  been  certified  as  Y2K 
compliant); 

•  did  not  include  a  standard  methodology  for  ongoing  tracking 
of  the  tests;  and 

•  did  not  provide  for  a  risk  assessment  and  management 
program. 

As  a  result,  DFAS  needed  to  take  alternative  measures  to  provide 
assurance  that  testing  would  mitigate  risks  and  that  the  systems  that  pay 
over  4.5  million  active-duty  military,  retirees,  and  annuitants  would 
continue  to  function  properly. 

DoD  Military  Pay  Mission 

Mission  of  Military  Pay.  To  conduct  end-to-end  assessments,  DFAS  identified 
seven  critical  business  processes  referred  to  as  events.  DFAS  identified  military 
pay  as  one  of  those  events.  The  military  pay  mission  is  to  process  military  and 
retiree  payroll  and  make  annuity  payments  resulting  from  notification  of  death. 
The  military  pay  systems  transmit  data  to  the  Federal  Reserve  Banks  and 
disbursing  systems  (the  Marine  Corps  military  pay  system  has  its  own 
disbursing  module)  for  actual  payment.  Disbursing  is  one  of  the  seven  events 
and  is  covered  separately.  End-to-end  testing  of  military  pay  began  in  May 
1999  and  should  conclude  in  October  1999.  As  of  August  27,  1999,  the 
schedule  for  end-to-end  testing  was  as  follows. 


5 


•  The  Defense  Joint  Military  Pay  System  (DJMS)  Active  Component 
began  end-to-end  testing  on  August  23,  1999,  and  should  be 
complete  by  October  31,  1999. 

•  The  DJMS  Reserve  Component  began  end-to-end  testing  on  July  8, 
1999,  and  will  finish  in  late  September  1999.  The  Naval  Reserve 
Component  of  DJMS  will  not  start  testing  until  October  13,  1999, 
and  should  be  complete  by  October  31,  1999. 

•  End-to-end  testing  of  the  Defense  Retiree  and  Annuitant  Pay  System- 
Retiree  Casualty  Pay  Subsystem  (DRAS-RCPS)  began  on  May  3, 
1999,  and  was  completed  on  August  19,  1999. 

•  The  Defense  Retiree  and  Annuitant  Pay  System-Annuitant  Pay 
Subsystem  (DRAS-APS)  began  end-to-end  testing  on  June  4,  1999. 
Test  completion  was  scheduled  for  August  13,  1999.  However,  one 
test  remains  with  the  Defense  Manpower  Data  Center;  the  estimated 
completion  date  is  no  later  than  October  31,  1999. 

•  End-to-end  testing  of  the  Marine  Corps  Total  Force  System 
(MCTFS)  began  on  June  21,  1999,  and  was  completed  on 
August  12,  1999. 

Military  Pay  Systems  and  Critical  Interfacing  Systems.  The  Master  Plan 
divided  the  military  pay  event  into  the  following  threads: 

•  satisfying  a  payday  for  Active  Component  personnel; 

•  satisfying  a  payday  for  Reserve  Component  personnel; 

•  satisfying  a  payday  for  retirees;  and 

•  making  annuitant  payments. 

Critical  Interfacing  Systems.  DFAS  headquarters  identified  four  DFAS-owned 
computer  systems  necessary  to  support  the  military  pay  mission.  The  four 
systems  are: 

•  DJMS  Active  and  Reserve  Components, 

•  MCTFS, 

•  DRAS-RCPS,  and 

•  DRAS-APS. 
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The  system  managers  took  the  initiative  of  preparing  the  test  plans  for  each  of 
their  systems,  including  identifying  the  interfaces  to  be  tested  for  their 
respective  systems.  System  managers  determined  that  about  20  percent  (or  71 
of  356)  of  the  interfaces  contained  the  critical  military  pay  functions  for 
end-to-end  testing. 

Execution  of  End-to-End  Test  Procedures 


The  end-to-end  test  plans  for  military  pay,  prepared  by  the  four  system 
managers,  were  completed  before  DFAS-wide  guidance  was  issued.  The  DFAS 
Y2K  Project  Office  (the  Project  Office)  issued  the  guidance  on  May  11,  1999. 
However,  the  DFAS  military  pay  functional  proponent  (the  functional 
proponent)  and  the  system  managers  recognized  that  little  time  was  allowed  for 
preparing  the  plans  and  developed  their  plans  before  the  guidance  was 
published.  As  a  result,  the  event  plans  did  not  include  key  test  procedures,  as 
prescribed  in  the  DFAS  Master  Plan.  Specifically,  the  plans: 

•  did  not  provide  for  testing  all  critical  dates; 

•  provided  for  testing  in  a  simulated  environment,  without  an  analysis 
of  the  risks  involved; 

•  did  not  require  baselines  as  stated  in  the  Master  Plan  (the  baseline  is 
the  set  of  known  end-to-end  test  inputs  and  outputs  extracted  from 
systems  that  have  been  certified  as  Y2K  compliant); 

•  did  not  include  a  standard  methodology  for  ongoing  tracking  of  the 
tests;  and 

•  did  not  provide  for  a  risk  assessment  and  testing  of  critical  dates. 

Testing  of  Critical  Dates.  DFAS  military  pay  systems  plans  did  not  provide 
for  testing  all  of  the  critical  Y2K  dates.  Personnel  in  the  Project  Office  stated 
that  they  had  initially  intended  to  require  testing  of  five  specific,  critical  dates, 
as  recommended  by  the  DoD  Y2K  Testing  Office.4  However,  the  Project 
Office  personnel  stated  that  because  the  DoD  Y2K  Testing  Office  had 
recommended,  but  did  not  require  testing  the  dates,  the  requirement  to  test  all 
five  critical  dates  was  dropped  from  the  Master  Plan. 

Critical  Dates  for  Military  Pay  Systems.  The  functional  proponent  stated  that 
the  critical  dates  for  the  military  pay  systems  were  January  1,  2000,  and 
February  29,  2000.  However,  MCTFS  was  scheduled  for  testing  only  on 
February  29,  2000.  The  functional  proponent  stated  that  because  the  military 
pay  systems  operated  on  a  calendar  year  basis,  testing  the  fiscal  year-end  dates 
(October  1,  1999,  and  October  1,  2000)  was  not  required.  Further,  the 
functional  proponent  also  stated  that  testing  for  the  January  1,  2001,  date  would 


4  Those  dates  were  the  FY  2000  crossover,  the  calendar  year  2000  crossover,  the  FY  2001  crossover,  the 
calendar  year  2001  crossover,  and  the  leap  year  (February  29,  2000). 
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be  difficult  because  of  the  time  and  funding  constraints  of  aging  the  military  pay 
databases.  Consequently,  the  functional  proponent  believed  that  the  risk  of  not 
end-to-end  testing  all  five  critical  dates  would  be  low. 

Dates  Tested  During  Y2K  Certification.  The  functional  proponent  also  stated 
that  the  five  dates  had  been  tested  during  the  Y2K  certification  of  each  military 
pay  system;  therefore,  the  functional  proponent  was  confident  that  the  systems 
would  function  properly  on  the  recommended  dates.  However,  these  dates  were 
not  tested  from  end  to  end  with  the  interfacing  systems.  The  functional 
proponent  believed  that  this  limited  testing  was  adequate,  based  on  the 
assumption  that  the  greatest  risk  was  whether  the  military  pay  systems  would 
recognize  leap  year  dates  correctly. 

Independent  Verification  of  Prior  Certifications.  Because  Y2K  end-to-end 
certification  testing  was  not  done,  the  Project  Office  and  the  functional 
proponent  assumed  a  higher  risk.  To  reduce  this  risk,  an  independent 
verification  of  the  prior  certifications  will  be  conducted  to  determine  whether 
previous  tests  of  the  military  pay  systems  met  the  intent  of  end-to-end  testing. 
The  Joint  Interoperability  Test  Command  will  perform  these  reviews  for  the 
Project  Office  to  determine  whether  the  intent  of  end-to-end  testing  has  been  met 
or  farther  end-to-end  testing  is  necessary.  The  Joint  Interoperability  Test 
Command  reviews  for  military  pay  systems  are  scheduled  for  October  4 
through  18,  1999. 

Risks  of  Simulated  Testing.  DFAS  system  managers  had  not  documented  the 
increased  risks  of  the  plans  to  use  simulation  software,  rather  than  time 
machines,  for  testing.  The  Master  Plan  required  tests  to  be  performed  in  a  live 
(production)  environment,  if  possible,  and  to  use  time  machines  when  a  live 
environment  was  not  feasible.  A  time  machine  changes  the  test  environment 
(hardware  and  software)  to  Y2K;  simulation  software  changes  only  the  dates  on 
software  files.  The  Master  Plan  stated  that  if  time-machine  testing  were  not 
possible,  the  testing  organization  would  have  to  use  simulation  and  document  the 
reasons  for  doing  so,  as  well  as  the  associated  risk. 

Use  of  a  Time-Machine  Environment.  The  Project  Office  proposed  requiring 
the  use  of  a  time-machine  environment  for  Y2K  end-to-end  testing.  However, 
the  functional  proponent  stated  that  the  time  and  money  constraints  imposed  a 
hardship,  and  the  requirement  was  dropped.  The  functional  proponent  had 
stated  that  DISA  probably  would  not  have  enough  time  machines  to  conduct  the 
testing.  Further,  the  Project  Office  did  not  require  the  functional  proponent  to 
prepare  an  analysis  of  the  risks  of  using  simulation  software  compared  to  a  time- 
machine  environment.  On  July  19,  1999,  the  functional  proponent  stated  that 
additional  time  machines  had  been  made  available  and  would  be  incorporated 
into  the  testing  for  all  systems  except  DRAS-APS  and  DRAS-RCPS. 
DRAS-RCPS  will  perform  limited  retesting  if  a  time  machine  is  available,  and 
DRAS-APS  will  not  use  a  time  machine.  However,  we  determined  that  only 
MCTFS  used  the  time  machine  to  conduct  end-to-end  tests. 
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Available  Tools.  The  DFAS  decision  not  to  use  available  time  machines  should 
be  reconsidered.  Time  machines  can  find  errors  that  simulation  software 
cannot.  Additionally,  code  scanners  can  also  find  errors  that  simulation 
software  can  miss.  The  DoD  Y2K  Program  Office  has  strongly  endorsed  the 
use  of  code  scanners  and  has  bought  licenses  for  two  such  tools,  which  have 
been  made  available  for  DoD  Components’  use.  Numerous  other  products  can 
be  procured  as  well. 

Use  of  Baseline  Data.  The  Master  Plan  specifically  required  the  use  of 
baselines  for  end-to-end  testing.  A  baseline  is  a  set  of  known  inputs  and  outputs 
that  define  the  state  of  a  system  at  a  point  in  time  and  is  used  as  a  measure  for 
future  test  comparisons.  The  use  of  a  baseline  allows  testers  to  identify 
deviations  from  test  results  and  errors  in  logic  and  enhances  the  viability  of  the 
test  product.  A  baseline  test  is  run  to  provide  the  necessary  data. 

Current  Baseline  Test.  One  of  the  four  military  pay  systems,  DRAS-APS, 
plans  to  run  a  current  baseline  test  to  compare  with  the  end-to-end  test  results. 
Testers  for  the  other  systems  stated  that  the  requirement  to  produce  a  baseline 
occurred  after  the  event  plans  had  been  made.  Further,  a  tester  stated  that 
conducting  a  current  baseline  test  and  the  end-to-end  test  would  double  the 
amount  of  time  required  to  accomplish  the  testing.  However,  personnel  in  the 
Project  Office  stated  that  the  August  1999  target  date  could  be  extended. 

Developing  the  Expected  Results.  In  response  to  concerns  about  the  lack  of 
baselines,  the  functional  proponent  stated  that  all  system  managers  had 
developed  the  expected  results  for  their  tests.  The  functional  proponent  also 
stated  that  since  the  Y2K  certification  testing  was  conducted,  DIMS  and 
MCTFS  had  made  no  major  computational  changes  that  would  affect  test 
results.  In  this  case,  the  lack  of  a  current  baseline  could  distort  the  test  results. 
Specifically,  it  may  be  difficult  to  determine  whether  a  test  failure  is  attributable 
to  Y2K  testing  scenarios  or  to  errors  made  by  functional  personnel  when 
modifying  a  system’s  software  after  the  Y2K  certification  testing. 

Time  Needed  to  Conduct  a  Baseline  Test.  The  functional  proponent  explained 
that  military  payroll  processing  is  cyclical,  and  that  if  a  current  baseline  were 
necessary,  this  would  double  the  time  needed  for  testing.  Because  the  definition 
of  baseline  data  had  not  been  properly  explained  to  the  testers,  and  they  were 
operating  under  time  constraints,  the  functional  proponent  believed  that  running 
baseline  tests  was  not  reasonable.  However,  that  assumption  increased  the  risk 
that  the  results  expected  from  the  tests  may  be  inaccurate.  We  recommended 
that  the  functional  proponent  and  the  Project  Office  review  how  the  testers  and 
system  managers  had  prepared  the  expected  results  and  assess  the  risks  involved 
in  using  those  data.  On  July  19,  1999,  the  functional  proponent  responded  by 
stating: 


“The  baseline  data  each  of  the  centers  will  be  using  is  the  payroll  data 
for  the  prior  month... The  baseline  data  will  be  compared  with  the  test 
results  and  differences  reviewed.  Any  differences  that  cannot  be 
attributed  to  across-the-board  pay  increases,  promotions,  demotions, 
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longevity  increases,  end-of-service  dates,  retirements,  etc.  will  be 
considered  discrepancies  and  will  be  investigated  as  to  cause.  Based 
on  this  approach,  the  risk  level  associated  with  the  use  of  the  chosen 
baseline  is  assessed  as  low.” 

Although  we  cannot  verify  that  the  risk  of  using  the  chosen  baselines  is  low,  the 
functional  proponent  has  addressed  our  concerns  about  reviewing  and  assessing 
the  risks  involved  in  using  baseline  data. 

Test  Readiness  Reviews.  The  Master  Plan  stated  that  one  of  the  exit  criteria 
for  the  planning  phase  of  end-to-end  testing  was  conducting  a  test  readiness 
review  and  resolving  issues  from  the  review.  As  stated  in  DFAS  8000. 1-R,  test 
readiness  reviews  determine  whether  the  systems  are  prepared  to  undergo  the 
next  level  of  testing.  The  Project  Office  personnel  and  the  functional  proponent 
stated  that  the  staff  and  resources  to  conduct  test  readiness  reviews  were  not 
available.  In  place  of  the  readiness  reviews,  Project  Office  personnel  stated  that 
site  visits  were  conducted  to  ensure  that  the  testing  personnel  understood  what 
was  expected  from  them.  However,  those  visits  did  not  produce  documented 
evidence  that  the  systems  were  ready  for  testing  or  that  reviews  of  test  plans  had 
been  performed.  Project  Office  personnel  also  stated  that  the  testing  process 
would  be  reviewed  after  the  testing  is  complete.  We  do  not  see  the  benefit  of 
conducting  test  readiness  reviews  after  testing  has  been  completed.  On  July  19, 
1999,  the  functional  proponent  addressed  these  concerns  by  stating: 

“A  template  for  end-to-end  status  reporting  was  developed  after  the 
IG  Audit  began  for  each  of  the  test  threads  and  is  the  standard 
methodology  currently  in  place  for  tracking  the  testing  progress  at 
each  of  the  centers.  Based  upon  a  review  of  the  templates,  the  risk 
level  associated  with  their  use  is  assessed  as  low.” 

These  templates  were  designed  to  report  the  status  of  testing,  rather  than  to 
determine  whether  the  systems  were  ready  to  be  tested.  The  templates  are  good 
management  tools,  but  are  not  a  substitute  for  test  readiness  reviews.  We 
recommended  that  DFAS  provide  the  staff  and  resources  to  conduct  test 
readiness  reviews,  because  the  reviews  cannot  reduce  risks  after  testing  has 
started. 

Use  of  Checklists  to  Track  Test  Progress.  The  Master  Plan  included  four 
checklists  to  be  used  by  personnel  at  DFAS  headquarters,  the  functional 
proponent,  the  event  leader,  and  the  tester  to  assess  the  effectiveness  of  end-to- 
end  testing  at  each  level.  The  Master  Plan  stated  that  these  checklists  would 
“provide  independent  auditors  with  evidence  of  compliance  with  the  end-to-end 
test  requirement.  ”  Three  of  the  four  military  pay  system  managers  and  testers 
completed  the  planning  sections  of  the  checklists  at  the  request  of  the  auditors. 
The  checklists  would  provide  documentation  that  important  processes  were 
addressed  during  the  end-to-end  testing  and  would  aid  in  providing  proof  of  the 
testing.  However,  neither  the  Project  Office,  nor  the  functional  proponent 
required  use  of  the  entire  checklists. 
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Completed  Planning  Checklists.  The  degree  of  compliance  with  use  of  the 
checklist  was  low.  However,  the  functional  proponent  stated  that  use  of  the 
checklists  would  not  be  required. 

Informal  Tracking  Methods.  The  Project  Office  stated  that  an  informal 
method  of  tracking  the  testing  process  would  be  developed.  However,  the 
tracking  would  be  done  after  the  completion  of  testing.  The  functional 
proponent  stated  that  informal  methods  would  also  be  used  to  track  the  progress 
of  ongoing  tests,  based  on  feedback  from  system  managers.  The  system 
managers  may  not  follow  end-to-end  guidance;  therefore,  the  informal  tracking 
of  progress  based  on  feedback  from  system  managers  does  not  ensure  that  end- 
to-end  test  requirements  will  be  satisfied. 

Effective  End-to-End  Testing  Requirements.  The  current  process  carries  a 
substantial  risk  that  deviations  from  effective  end-to-end  testing  requirements 
will  not  be  discovered  promptly.  DFAS  should  require  that  the  checklists  be 
completed,  signed,  reviewed,  and  maintained  as  documentation  that  essential 
steps  were  taken  to  accomplish  the  goals  of  end-to-end  testing.  Although  the 
functional  proponent  stated  that  the  system  managers  had  their  own  methods  for 
evaluating  progress,  use  of  the  checklists  would  set  a  standard  among  the  four 
threads  in  the  military  pay  event. 

Risk  Assessment  and  Management.  Although  the  Master  Plan  stated  that  a 
program  to  identify,  track,  and  manage  risks  would  be  part  of  the  management 
controls  for  end-to-end  testing,  the  functional  proponent  for  military  pay  stated 
that  updated  risk  assessments  were  not  needed  for  the  military  pay  area. 
Therefore,  a  risk  management  program  for  military  pay  end-to-end  testing  will 
not  be  implemented. 

The  functional  proponent  stated  that  the  initial  risk  assessments  prepared  for 
each  system  during  the  remediation  phases  of  the  overall  Y2K  project  were  still 
valid,  and  no  updates  were  necessary.  The  Management  Plan  for  the 
remediation  phase  required  that  risk  assessments  be  prepared  and  updated  as  exit 
criteria  for  four  of  the  five  phases.  Because  of  the  lack  of  time  and  resources 
and  the  number  of  deviations  from  the  Master  Plan,  a  risk  management  program 
for  military  pay  must  be  put  in  place  to  ensure  that  the  end-to-end  testing 
process  is  conducted  with  minimal  risk.  We  recommended  that  the  functional 
proponent  request  updated  risk  assessments  from  each  of  the  system  managers 
and  review  those  assessments  for  opportunities  to  mitigate  the  testing  risks. 
Before  this  report  was  issued,  the  functional  proponent  addressed  our  concerns 
by  stating  that  an  informal  risk  assessment  process  was  being  used  and  steps 
were  under  way  to  implement  a  formal,  documented  risk  management  program. 
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DFAS  Comments  on  Preliminary  Audit  Results 


On  May  28,  1999,  the  Inspector  General,  DoD,  provided  preliminary  audit 
results  in  a  memorandum  to  the  DFAS  Director  for  Information  and 
Technology.  DFAS  responded  in  a  memorandum  dated  June  8,  1999,  which 
addressed  six  issues.  The  sections  of  the  memorandum  on  Master  Plan 
checklists,  interfacing  systems,  and  critical  crossover  dates  are  discussed  below. 

Master  Plan  Checklists.  Our  memorandum  expressed  concern  that  the  Master 
Plan  did  not  require  completion  of  the  checklists.  DFAS  responded  that  the  use 
of  checklists  will  be  encouraged,  but  not  mandatory.  DFAS  also  stated  that  the 
checklists  were  issued  as  tools  to  assist  its  personnel  in  planning,  tracking,  and 
conducting  end-to-end  testing.  Further,  because  each  business  area  had 
established  a  normal  testing  practice,  DFAS  did  not  make  the  checklists 
mandatory.  We  recommended  that  DFAS  reconsider  making  the  checklists  a 
mandatory  part  of  end-to-end  testing,  as  the  checklists  provide  an  excellent 
means  to: 

•  ensure  the  completion  of  essential  steps  in  the  planning  process, 

•  ensure  compliance  with  requirements  of  the  Master  Plan,  and 

•  allow  for  early  correction  of  deviations  or  omissions  from  the  Master 
Plan. 

Interfacing  Systems.  Our  memorandum  stated  that  DFAS  relies  heavily  on 
interfacing  systems  to  provide  a  majority  of  data.  Therefore,  coordination  and 
compatibility  of  data  exchange  with  interfacing  systems  are  critical  to  ensuring 
successful  Y2K  end-to-end  tests.  DFAS  concurred,  stating  that  its  system 
managers  were  aware  of  the  status  of  each  of  its  interfacing  partners  and  that 
DFAS  would  continue  to  track  and  monitor  the  status  of  each  partner.  DFAS 
did  not  provide  details  of  how  it  would  track  or  monitor  the  progress  of  the 
partners.  During  the  audit,  we  found  that  military  pay  system  managers  could 
confirm  the  status  of  their  systems,  but  could  not  always  confirm  the  status  of 
systems  not  owned  by  DFAS. 

Critical  Crossover  Dates.  Our  memorandum  expressed  concern  that  DFAS 
was  not  requiring  the  testing  of  all  the  critical  crossover  dates  in  its  end-to-end 
tests.  Conceptually,  end-to-end  testing  involves  the  interoperability  of  a  number 
of  systems.  Omission  of  specific  date  testing  in  one  system  could  invalidate  the 
date  testing  in  another.  The  purpose  of  Y2K  end-to-end  testing  is  to  verify  that 
the  set  of  interrelated  systems  supporting  DFAS  business  processes,  such  as 
DoD  military  pay,  operate  and  process  Y2K-related  data  appropriately. 
Therefore,  testing  of  all  dates  becomes  essential.  For  example,  the  military  pay 
event  plans  did  not  include  the  testing  of  many  critical  dates  in  the  Master  Plan. 
The  functional  proponent  stated  that  the  system  managers  had  tested  those  dates 
with  their  interface  partners  during  system-level  testing.  Because  all  dates  were 
not  tested,  the  disbursing  and  accounting  events  could  be  affected.  DFAS 
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responded  that  it  concurs  and  has  encouraged  coordination  of  dates  among 
partners.  DFAS  has  also  authorized  its  functional  managers  (proponents)  to 
determine  which  dates  should  be  tested. 

Summary  of  Military  Pay  End-to-End  Test  Planning 

DFAS  had  accurately  documented  that  the  end-to-end  testing  for  military  pay 
and  other  functional  areas  carried  significant  risks.  DFAS  stated  that: 

•  the  time  available  for  testing  is  short, 

•  the  test  scope  may  be  too  limited  to  provide  reasonable  assurance, 

•  the  test  environment  may  not  be  realistic, 

•  test  schedules  may  slip, 

•  costs  may  be  prohibitive, 

•  segment  testing  will  be  done  instead  of  end-to-end  testing, 

•  a  lack  of  participation  from  interfacing  organizations  was  probable, 
and 

•  including  overseas  components  in  the  testing  will  be  difficult. 

To  alleviate  some  risk,  the  DFAS  functional  proponent  stated  that  DFAS  had 
reviewed  the  selection  of  all  critical  interfaces.  The  functional  proponent  also 
stated  that  the  validity  of  the  testing  constraints  and  assumptions  in  the  Master 
Plan  had  been  verified.  Specifically,  the  functional  proponent  stated: 

“All  systems  except  Navy  systems  have  been  Y2K  certified  and  DISA 
has  provided  the  required  resources  in  a  timely  fashion  except  the 
time  machine  for  DRAS-RCPS.  Both  exceptions  are  expected  to  be 
cleared  before  October  30,  1999.” 

Other  specific  areas  of  risk  need  to  be  addressed.  These  areas  include  the  dates 
tested,  test  environment,  test  readiness  reviews,  use  of  code  scanners,  and  risk 
management.  On  July  14,  1999,  we  informed  DFAS  of  our  concerns  in  these 
areas.  Because  the  issues  identified  in  this  report  are  not  likely  to  be  resolved 
before  testing  is  completed,  DFAS  should  take  alternative  measures  to  reduce 
the  risk  that  military  pay  systems  will  be  unable  to  process  data  successfully 
after  2000.  Alternative  measures  may  include  performing  supplementary  end- 
to-end  tests,  using  code  scanners,  or  expanding  the  contingency  plans. 
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Recommendation  and  Management  Comments 


We  recommend  that  the  Director,  Defense  Finance  and  Accounting  Service, 
direct  the  Defense  Finance  and  Accounting  Service  Year  2000  Project  Office 
and  the  functional  proponent  to  take  alternative  measures  to  reduce  the  risk 
that  military  pay  systems  will  be  unable  to  process  data  successfully  after 
2000.  Alternative  measures  may  include  performing  supplementary  end-to- 
end  tests,  using  code  scanners,  or  expanding  the  contingency  plans. 

Management  concurred.  The  Defense  Finance  and  Accounting  Service, 
Director,  Information  Technology,  stated  that: 

•  DFAS  has  hired  the  Joint  Interoperability  Test  Command  as  an 
independent  third  party  to  review,  validate,  and  assist  in  documenting 
the  end-to-end  testing  of  systems. 

•  Additional  contingency  plans  have  been  drafted,  and  contingency 
testing  beyond  the  minimum  requirements  will  be  conducted. 

•  An  independent  contractor  has  performed  code  scanning  of  the 
Defense  Joint  Military  Pay  System,  and  the  other  military  pay 
systems  will  be  scanned  before  November  30,  1999. 
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Appendix  A.  Audit  Process 


This  is  one  in  a  series  of  reports  being  issued  by  the  Inspector  General,  DoD,  in 
accordance  with  an  informal  partnership  with  the  DoD  Chief  Information 
Officer  to  monitor  DFAS  efforts  to  address  the  Y2K  computing  challenge.  For 
a  listing  of  audit  projects  addressing  the  issue,  see  the  Y2K  website  at 
http :  //www.  ignet.gov . 

Scope  and  Methodology 


We  reviewed  Y2K  reporting  requirements  and  policies  issued  by  the  Office  of 
the  Secretary  of  Defense  and  DFAS.  We  reviewed  the  DFAS  Y2K  Master  Plan 
and  event  plans  and  held  discussions  with  DFAS  managers  to  obtain 
information  on  the  roles  and  responsibilities  of  its  Y2K  managers. 

DoD-wide  Corporate-Level  Government  Performance  and  Results  Act 
Goals.  In  response  to  the  Government  Performance  and  Results  Act,  the  DoD 
has  established  2  DoD-wide  goals  and  7  subordinate  performance  goals.  This 
report  pertains  to  achievement  of  the  following  goal  and  subordinate 
performance  goals. 

Goal  2:  Prepare  now  for  an  uncertain  future  by  pursuing  a  focused 
modernization  effort  that  maintains  U.S.  qualitative  superiority  in  key 
warfighting  capabilities.  Transform  the  force  by  exploiting  the  revolution  in 
military  affairs,  and  reengineer  DoD  to  achieve  a  21st  century  infrastructure. 

•  Performance  Goal  2.2:  Transform  U.S.  military  forces  for  the 
future.  (00-DoD-2.2) 

•  Performance  Goal  2.3:  Streamline  the  DoD  infrastructure  by 
redesigning  the  Department’s  support  structure  and  pursuing 
business  practice  reforms.  (00-DoD-2.3) 

General  Accounting  Office  High-Risk  Area.  The  General  Accounting  Office 
has  identified  several  high-risk  areas  in  DoD.  This  report  provides  coverage  of 
the  Information  Management  and  Technology  high-risk  area. 

Audit  Type,  Dates,  and  Standards.  We  performed  this  program  audit  from 
April  through  July  1999,  in  accordance  with  auditing  standards  issued  by  the 
Comptroller  General  of  the  United  States,  as  implemented  by  the  Inspector 
General,  DoD.  We  used  nonstatistical  sampling  methods  for  this  audit. 

Contacts  During  the  Audit.  We  visited  or  contacted  individuals  and 
organizations  within  DoD.  Further  details  are  available  on  request. 

Use  of  Computer-Processed  Data.  We  did  not  use  computer-processed  data  to 
perform  this  audit. 
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Management  Control  Program.  We  did  not  review  the  management  control 
program  related  to  the  overall  audit  objective  because  DoD  recognized  the  Y2K 
issue  as  a  material  management  control  weakness  area  in  its  FY  1998  Annual 
Statement  of  Assurance. 

Prior  Audit  Coverage 


The  General  Accounting  Office  and  the  Inspector  General,  DoD,  have 
conducted  multiple  reviews  related  to  Y2K  issues.  General  Accounting  Office 
reports  can  be  accessed  on  the  internet  at  www.gao.gov.  Inspector  General, 
DoD,  reports  can  be  accessed  on  the  internet  at  www.dodig.osd.mil. 
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Appendix  B.  Descriptions  of  DoD  Military  Pay 

Systems 


Defense  Joint  Military  Pay  System 


The  Defense  Joint  Military  Pay  System  (DJMS)  provides  pay  services  for 
active-duty  and  Reserve  personnel  in  the  Army,  Navy,  and  Air  Force. 

Members  of  the  National  Guard,  the  Reserve  Officer  Training  Corps  (ROTC), 
the  Junior  ROTC,  the  Health  Professionals  Incentive  Program,  and  the  military 
academies  are  also  paid  through  DJMS. 

The  system  databases,  located  in  Denver,  Colorado,  and  Chambersburg, 
Pennsylvania,  support  more  than  2.2  million  accounts  and  process  more  than 
6  million  transactions  monthly.  The  heart  of  the  system  is  a  central  automated 
master  file  containing  Service  members’  master  military  pay  accounts.  The 
master  military  pay  account  contains  data  about  the  Service  member  that  affect 
pay  accrual  and  distribution.  Data  flow  into  the  master  military  pay  account  and 
update  the  system,  providing  daily  output  that  results  in  a  payroll. 

The  DJMS  program  manager  is  responsible  for  scheduled  implementations  of 
enhancements  as  well  as  making  changes  required  by  legislation. 

Marine  Corps  Total  Force  System 


The  Marine  Corps  Total  Force  System  (MCTFS),  jointly  owned  by  DFAS  and 
the  Marine  Corps,  is  an  integrated  system  with  personnel,  payroll,  and 
disbursing  modules.  MCTFS  supports  both  Active  and  Reserve  Components  of 
the  Marine  Corps  and  the  personnel  management  of  all  retired  Marines. 

The  MCTFS  central  database,  located  in  Kansas  City,  Missouri,  supports  more 
than  450,000  accounts.  The  accounts  are  available  for  payroll,  personnel 
management,  and  management  reporting.  MCTFS  is  used  during  peacetime, 
wartime,  and  in  times  of  crisis.  It  supports  worldwide  deployments  and 
contingencies  and  provides  for  seamless  mobilization  of  Reserve  units  and 
individuals. 

Defense  Retiree  and  Annuitant  Pay  System-Annuitant  Pay 
Subsystem 


The  Defense  Retiree  and  Annuitant  Pay  System-Annuitant  Pay  Subsystem 
(DRAS-APS)  provides  pay  services  for  the  survivors  of  military  personnel.  The 
surviving  annuitants  are  paid  by  the  DFAS  Denver  Center.  DRAS-APS 
processes  more  than  250,000  annuity  accounts. 
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Defense  Retiree  and  Annuitant  Pay  System-Retiree  Casualty 
Pay  Subsystem 


The  Defense  Retiree  and  Annuitant  Pay  System-Retiree  Casualty  Pay  Subsystem 
(DRAS-RCPS)  provides  pay  services  for  retired  military  personnel.  The  DFAS 
Cleveland  Center,  Cleveland,  Ohio,  provides  retired  pay  to  approximately 
1.9  million  retirees. 

DRAS  and  its  subsystems  helped  to  standardize  retired  and  annuity  pay  policies 
and  procedures  across  all  DoD  Military  Services. 
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Appendix  C.  Inspector  General,  DoD,  Interim 

Reporting  on  Test  Plans 


INSPECTOR  GENERAL 

DEPARTMENT  OF  DEFENSE 
400  ARMY  NAVY  DRIVE 
ARLINGTON.  VIRGINIA  22202-2884 


m  28  1999 


MEMORANDUM  FOR  DIRECTOR  FOR  INFORMATION  AND  TECHNOLOGY, 
DEFENSE  FINANCE  AND  ACCOUNTING  SERVICE 


SUBJECT:  Status  of  Audits  of  Finance  Functional  Area  Year  2000  End-to-End  Tests 


In  April  1999,  we  initiated  the  following  audit  projects  to  evaluate  the 
effectiveness  of  Y2K  end-to-cnd  testing  by  the  Defense  Finance  and  Accounting 
Services  (DFAS).  The  projects  were  aligned  by  functional  area  in  accordance  with  the 
functional  break-out  identified  by  DFAS 


Civilian  Pay 

Military /Re  tixee/Annuitant  Pay 

Vendor/Contractor  Pay 

Transportation  Pay 

Disbursing 

Accounting 

Travel  Pay 


Project  9FG-9025 
Project  9FG-9026 
Project  9FG-9027 
Project  9FG-9028 
Project  9FG-9029 
Project  9FG-9030 
Project  9FG-9031 


Our  review,  to  date,  has  focused  on  analyzing  the  adequacy  of  test  plans  for  the 
seven  areas.  We  evaluated  the  adequacy  of  the  DFAS  Y2K  test  plans  using 
requirements  contained  in  the  DoD  Y2K  Management  Plan,  Version  2,1,  Appendix  I; 
the  DFAS  Y2K  Management  Plan,  Version  1.0;  the  DFAS  Y2K  End-to-End  Master 
Plan,  Version  2  1;  the  DFAS  Regulation  8000. 1-R,  '’Information  Management  and 
Instruction  Guidance,”  Version  5.0;  and  the  GAO  Operational  Evaluation  Assessment 
Tool .  We  anticipate  future  audits  will  assess  test  results  and  contingency  planning 
efforts  by  DFAS. 


Because  of  the  urgency  of  Year  2000  efforts,  our  intent  is  to  communicate 
potential  areas  of  concern  as  quickly  as  possible  so  that  management  may  address  these 
issues  in  a  timely  manner.  The  attachment  to  this  memorandum  reports  the  initial 
results  of  our  review  During  our  preliminary  review,  we  identified  concerns  regarding 
the  adequacy  of  DFAS  planning  efforts  for  functional  end-to-end  testing.  If  these 
concerns  are  not  addressed,  there  is  increased  risk  that  DFAS  end-to-end  testing  may 
not  detect  a  significant  Y2K  problem.  We  may  include  these  and  any  additional  issues 
in  a  draft  report  at  a  later  date.  We  request  that  you  provide  a  response  to  this 
memorandum  by  June  8,1999.  If  there  are  any  questions,  please  contact  Ms.  Kimberley 
Caprio,  Program  Director  at  (703)  604-9139  or  DSN  664-9139. 

/T  — 

F.  Jay  Lane 
Director 

Finance  and  Accounting  Directorate 
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DFAS  has  made  significant  progress  in  addressing  testing  requirements  for  its 
functional  areas  including  the  issuance  of  a  Master  Plan,  identification  of  levels  of 
responsibility,  and  checklists  for  test  planning  purposes.  During  our  review,  we 
identified  the  following  concerns  that  should  be  addressed  by  DFAS.  On  May  27, 

1999,  we  met  with  DFAS  officials  to  discuss  the  concerns  and  actions  to  be  taken. 

1.  Roles  and  Responsibilities.  The  DFAS  Master  Plan  identified  four  levels  of 
responsibility  for  end  to  end  testing  including  Headquarters  functional  proponents, 
systems  managers,  event  leaders,  and  thread  leaders.  The  Plan  defined  roles  and 
responsibilities  for  functional  proponents  and  systems  managers,  but  did  not  provide 
details  on  the  responsibilities  for  either  the  event  or  thread  leaders.  During  the  May 
27,  1999  meeting,  DFAS  Headquarters  personnel,  acknowledged  the  need  for  oversight 
and  agreed  to  provide  the  details  immediately. 

In  addition,  the  Master  Plan  was  not  issued  until  May  11,  1999,  and  in  some  cases  had 
not  arrived  at  the  event  leader  level  until  May  18,  1999  However,  functional  event 
plans  and  allocation  of  responsibilities  was  already  occuiring.  As  a  lesult,  the 
individuals  delegated  the  responsibilities  may  not  have  been  appropriate.  For  example, 
for  the  Travel  pay  event,  the  same  person  was  tasked  as  both  the  functional  proponent 
and  the  event  leader.  As  a  result,  it  precludes  the  separation  of  duties  by  allowing  one 
function  to  oversee  the  other  function.  To  ensure  that  the  4  levels  of  responsibility  are 
appropriately  staffed,  the  DFAS  Headquarters  Project  Office  should, review  the 
assigned  personnel  and  ensure  that  they  are  aware  and  understand  their  delegated 
responsibilities. 

2.  Master  Plan  Checklists.  The  DFAS  Y2K  Master  Plan  included  four  checklists 
to  be  used  by  DFAS  Headquarters  personnel,  the  functional  area  proponent,  the  event 
leader,  and  the  tester.  These  checklists  require  DFAS  personnel  to  assess  the 
effectiveness  of  the  end-to-end  testing  program  at  each  designated  level  including  such 
items  as  assessing  the  adequacy  of  testing  staff,  funds,  and  interface  agreements  The 
DFAS  Master  Plan  stated  that  these  checklists  would  “provide  independent  auditors 
with  evidence  of  compliance  with  the  end-to-end  test  requirements,”  however,  the 
Master  Plan  did  not  make  completion  of  the  checklists  mandatory. 

We  believe  the  checklists  should  be  mandatory  and  maintained  at  the  functional  level 
along  with  test  results.  The  2  to  3  page  checklists  provide  an  excellent  means  to 
ensure  and  document  that  essential  steps  were  taken  prior  to  performing  end  to  end 
testing  of  DFAS  functional  areas.  Completion  of  the  planning  section  of  these 
checklists  provides  a  tool  to  help  ensure  compliance  with  the  Master  Plan  requirements 
and  allow  for  early  corrections  of  deviations  or  omissions  from  the  plan  Further,  use 
of  the  checklist  affords  standardization  of  the  process  used  throughout  DFAS  for  end 
to  end  test  planning  efforts.  Without  the  use  of  the  checklists,  DFAS  lacks  assurance 
that  the  testing  was  complete,  adequate,  and  consistent.  We  also  believe  that  a 
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signature  block  or  notation  should  be  included  in  the  checklists  to  establish 
accountability  for  the  responses  and  to  facilitate  quick  actions  should  a  problem  arise 
later. 

3.  Interfacing  Systems.  DFAS  relies  heavily  on  interfacing  systems  to  provide 
the  majority  of  data  included  in  DFAS  systems.  As  such,  coordination  and 
compatibility  of  data  exchanged  with  interfacing  systems  is  critical  to  ensuring 
successful  Y2K  end  to  end  tests.  If  data  from  a  non-compliant  system  feeds  into  a 
DFAS  system,  the  potential  exists  for  the  DFAS  system  to  not  be  able  to  function 
properly  after  Y2K  The  level  of  assurance  being  obtained  by  DFAS  functional  area 
officials  regarding  Y2K  compliance  of  interfacing  systems  varies  from  exchanging 
documentation  to  merely  assuming  that  interfacing  systems  are  compliant  or  relying  on 
verbal  responses 

Given  the  significant  potential  impact  of  interfaces  on  successful  testing,  we  believe 
that  DFAS  functional  leaders  should  take  the  extra  step  to  validate  that  key  interfacing 
systems  are,  in  fact,  compliant.  Information  on  the  compliance  of  each  DoD  mission 
critical  system  should  be  available  in  the  OSD  database.  As  such,  DFAS  personnel  for 
the  functional  areas  should  be  able  to  access  the  database  and  validate  that  those 
applicable  interfacing  partners  are  clearly  designated  as  Y2K  compliant  before  entering 
the  end-to-end  test.  We  discussed  this  matter  with  DFAS  Headquarters  officials  who 
agreed  that,  while  they  are  only  testing  with  compliant  interfacing  partners,  it  is 
reasonable  that  DFAS  review  the  database  to  ensure  that  interfacing  partners  are 
compliant  prior  to  testing. 

4.  Critical  Crossover  Dates.  The  DFAS  Master  Plan  identified  5  critical  cross¬ 
over  dates  as  mandatory  for  inclusion  during  end-to-end  tests.  The  dates  arc  consistent 
with  the  5  dates  recommended  by  the  Assistant  Secretary  Defense  {Command,  Control, 
Communications,  and  Intelligence)  The  dates  are  fiscal  year  2000,  calendar  year 

2000,  leap  year  crossing  (February  29,  2000),  fiscal  year  2001 ,  and  calendar  year 

2001.  Developers  of  DFAS  test  plans  have  not  planned  to  test  all  5  dates  For 
example,  the  Marine  Corp  Total  Force  System  is  only  testing  the  leap  year  2000 
crossover.  The  Computerized  Accounts  Payable  System  is  not  testing  the  fiscal  year 
and  the  calendar  year  2001  crossovers.  The  reduced  number  of  dates  being  tested  is  a 
result  of: 

•  The  test  plans  being  developed  prior  to  the  issuance  of  the  DFAS  Master  Plan  on 
May  11,  1999, 

•  Personnel  pay  systems,  for  example,  not  being  impacted  by  fiscal  year  changes, 

•  Funding  being  allocated  based  on  test  plans  developed  prior  to  the  Master  Plan 

In  order  to  ensure  compatibility  of  interfacing  systems,  it  is  important  that  the  same 
dates  are  tested,  particularly  where  DFAS  systems  feed  data  to  other  systems.  For 
example,  data  from  systems  within  the  Travel  Pay  test  event  feed  into  systems  within 
the  Disbursing  test  event  Further,  once  processed  within  disbursing,  data  is  fed  to  both 
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accounting  and  back  to  travel  systems.  Incoming  files  to  the  Automated  Disbursing 
System  (ADS)  (part  of  the  Disbursing  test  event)  plan  to  test  all  dates  specified  in  the 
DFAS  Y2K  Master  Plan  However,  the  Travel  Pay  test  event  does  not  plan  to  test  the 
fiscal  year  2000  to  2001  crossover.  As  a  result,  the  potential  exists  that  data  relying  on 
the  fiscal  year  2000  to  2001  crossover  may  not  function  properly.  Meanwhile,  DFAS 
may  report  a  successful  test  based  on  the  less  than  5  dates  being  tested. 

It  is  important  that  interfacing  systems  select  test  dates  in  a  similar  maimer  to  ensure 
Y2K  data  flows  through  each  system  appropriately.  DFAS  functional  leaders  should 
ensure  that  critical  crossover  dates  for  each  of  the  seven  functional  areas  are  compatible 
prior  to  testing 

5.  Data  Collection  and  Analysis.  The  DoD  Y2K  Management  Plan  states  that 
Y2K  event  output  products  such  as  plans  and  procedures  should  specify  in  detail  what 
data  needs  to  be  collected,  who  will  analyze  the  data,  and  how  it  will  be  analyzed. 
Essentially,  the  requirement  is  to  define  expected  test  results.  Consistent  with  the  DoD 
Plan,  the  DFAS  Master  Plan  requires,  as  exit  criteria  to  the  test  planning  phase,  that 
responsible  parties  specify  pass/fail  criteria  for  all  tests,  that  data  collection  procedures 
are  in  place,  and  mechanisms  needed  to  capture  data  are  installed.  The  DFAS  Master 
Plan,  however,  does  not  specify: 

•  What  types  of  data  should  be  collected  to  ensure  consistency  in  reporting  test 
results 

•  A  methodology  for  each  DFAS  organization  to  document  the  data  collection 
process  in  the  appropriate  Event  Plan 

For  the  7  DFAS  functional  events,  data  collection  and  data  analysis  plans  are 
either  nonexistent  or  do  not  ensure  the  tests  will  be  judged  objectively.  For  example, 
the  Defense  Industrial  Financial  Management  System  (DIFMS)  Test  Plan,  which  is  part 
of  the  Accounting  Test  Event,  plans  to  review  reports,  queried  data,  and  DIFMS 
screens  to  accomplish  data  analysis,  but  did  not  establish  expected  test  results  criteria  or 
a  baseline  that  could  be  used  to  determine  the  adequacy  or  accuracy  pf  the  reports, 
queries,  and  screens.  As  another  example,  the  Civilian  Pay  Event  lacks  either  a  data 
collection  plan  or  a  data  analysis  plan  Instead,  the  Event  Leader  indicated  that  years  of 
prior  testing  and  DCPS  experience  will  identify  discrepancies  should  they  arise. 

Both  DoD  and  DFAS  require  the  establishment  of  a  structured  approach  to  testing 
including  identifying  expected  outcomes,  test  participants,  and  other  details.  Without 
such  plans,  there  is  no  organized  or  standardized  approach  between  the  participating 
systems,  nor  any  assurance  that  test  goals  are  met  and  tests  were  successful.  Given  the 
nature  of  end-to-end  testing,  with  its  large  numbers  of  participating  or  “partner" 
systems,  it  is  prudent  to  ensure  that  the  data  collection  is  as  consistent  as  possible  for 
each  event,  and  that  the  analysis  of  the  test  data  is  objective.  Without  the  definition  of 
data  collection  and  data  analysis  plans  before  testing  begins,  this  will  be  difficult. 
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DFAS  Functional  Test  Leaders  need  to  ensure  that  detailed  test  collection,  results,  and 
analysis  requirements  are  clearly  defined  prior  to  testing 

6.  Transportation  Pay  Event.  DFAS  identified  Transportation  Pay  as  one  of  the 
7  functional  areas  for  testing  purposes.  However,  DFAS  has  not  yet  developed  an  end- 
to-end  test  plan  for  the  event.  There  are  two  systems  involved  in  transportation,  the 
Defense  Transportation  Pay  System  (DTPS)  and  the  Military  Traffic  Management 
Command  -  Financial  Management  System  (MTMC-FMS).  The  Transportation  Pay 
Event  Leader  stated  that  MTMC-FMS  testing  during  Y2K  conversion  process 
accomplished  the  end-to-end  requirements  of  the  Master  Plan.  DFAS  has  subsequently 
contracted  with  the  Joint  Interoperability  Testing  Command  (JITC)  to  independently 
verity  and  validate  the  prior  testing.  We  plan  to  follow-up  on  this  functional  area 
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Appendix  D.  Defense  Finance  and  Accounting 

Service  Comments  on  Inspector 
General,  DoD,  Interim  Report 


DEFENSE  FINANCE  AND  ACCOUNTING  SERVICE 

1931  JEFFERSON  DAVIS  HIGHWAY 
ARLINGTON,  VA  22240-529  1 

'  8  1999 


MEMORANDUM  FOR  DIRECTOR,  FINANCE  AND  ACCOUNTING  DIRECTORATE 

OFFICE  OF  THE  INSPECTOR  GENERAL,  DEPARTMENT  OF 
DEFENSE 

SUBJECT:  Status  of  Audits  of  Financial  Functional  Area 

Year  2000  End-to-End  Tests 

The  attached  outlines  Defense  Finance  and  Accounting 
Service  ( DFAS)  response  to  the  DoD  Inspector  General's  (IG) 
initial  review  of  and  concerns  about  DFAS'  End-to-End  Test  (E2E ) 
Plans.  DFAS  recognizes  that  a  great  deal  of  work  is  still  to  be 
done  to  ensure  all  necessary  requirements  for  E2E  are 
accomplished.  To  meet  this  goal,  DFAS  has  conducted  meetings 
with  event  and  thread  leaders  to  review  all  E2E  guidelines  and 
requirements . 

All  concerns  addressed  in  the  DoD  IG's  memo  are  being 
addressed. 

Roles  and  Responsibilities:  Concur.  Action  to  expand 
event  and  thread  leader  roles  will  be  accomplished  by 
June  25,  1999. 

Master  Plan  Checklist:  Non-concur.  DFAS  will  not  mandate 
the  checklist. 

Interfacing  Systems:  Concur.  This  action  is  considered 
completed,  but  with  periodic  updates. 

Critical  Crossover  Dates:  Concur.  This  action  is 
completed . 

Data  Collection  and  Analysis:  Concur.  This  is  an  ongoing 
action  with  no  specific  target  date. 

Transportation  Pay  Event:  Concur.  This  is  an  ongoing 
action  with  a  target  completion  date  of  June  30,  1999. 


C.  Vance  Kauzlarich  CS 
Director  for  Information  and  Technology 
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Rolas  and  Responsibilities.  Concur.  DFAS  acknowledges  that 
testing  and  planning  activities  were  occurring  prior  to  the 
issuance  of  the  Master  Plan  on  6  May.  However,  several 
coordination  meetings  had  already  occurred  and  guidance  on 
developing  Event  Plans  was  issued  on  31  March.  DFAS  also 
acknowledges  the  need  to  clarify  and  augment  the  roles  and 
responsibilities  of  the  event  and  thread  leaders  in  the 
DFAS  E2E  Master  Plan.  We  are  currently  making  site  visits 
and  meeting  with  the  testing  teams  to  clarify  roles  and 
responsibilities  and  are  updating  the  Master  plan  as  well. 
It  should  be  noted  there  may  be  an  overlap  in  the  area  of 
responsibility,  due  to  the  fact  that  the  internal  DFAS 
support  structure  for  each  business  process/application  has 
a  great  bearing  upon  the  specific  breakout  of  roles  and 
responsibilities .  DFAS  does  not  view  this  as  a  conflict  or 
an  inappropriate  assignment  of  duties. 

Master  Plan  Checklist.  Non-concur.  DFAS  designed  and 
issued  these  checklists  as  tools  to  assist  DFAS  personnel 
responsible  for  planning,  tracking,  and  conducting  end  to 
end  testing.  Because  each  business  area/application  has  a 
normal  testing  practice  already  established,  DFAS  did  not 
make  the  checklists  mandatory,  and  would  prefer  to  keep  the 
use  of  checklists  optional.  However,  DFAS  will  encourage 
the  use  of  the  checklists  whenever  possible. 

Interfacing  Systems.  Concur.  DFAS  agrees  that  coordination 
and  compatibility  of  data  exchange  between  DFAS  systems  and 
their  interface  partners  is  essential  to  a  successful  Y2K 
effort.  DFAS  has  pursued  this  goal  for  the  past  two  years. 
DFAS  has  established  Interface  Agreements  with  all  of  its 
interface  partners.  This  effort  generated  in  excess  of 
1400  agreements.  In  addition,  DFAS  has  tracked  and  updated 
on  a  monthly  basis  the  status  of  testing  and  compliance  of 
each  of  its  interface  partners.  DFAS  system  mangers  are 
well  aware  of  the  status  of  each  of  its  partners.  DFAS 
will  continue  to  track  and  monitor  the  status  of  its 
interface  partners  mission  critical  and  other. 

Critical  Crossover  Dates.  Concur.  DFAS  acknowledges  the 
importance  of  testing  as  many  dates  as  possible,  and  the 
coordination  of  these  dates  among  partners.  All  DFAS 
managers  have  been  encouraged  to  coordinate  this  initiative 
with  all  pertinent  parties.  It  must  be  understood  that 
dates  do  not  necessarily  play  an  important  part  in  the 
relationship  of  one  system  to  another.  The  DFAS  E2E  Master 
Plan  has  recently  been  updated  to  empower  the  Functional 
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Managers  with  determining  which  dates  are  critical  for 
testing  within  their  specific  business  process.  We  have 
also  hired  JITC  to  independently  validate  and  verify  our 
planning  efforts. 

Data  Collection  and  Analysis.  Concur.  DFAS  agrees  that 
current  plans  lack  specific  exit  criteria  and  we  are  taking 
action  to  strengthen  this  area  of  our  plans.  DFAS  8000.1- 
R,  Part  E ,  Chapter  3,  Test  and  Evaluation  provides  guidance 
concerning  data  collection  and  analysis.  Our  central 
design  activities  normally  plan  and  execute  their  tests, 
using  this  guidance,  precluding  the  need  for  specific 
guidance  to  be  issued  relative  to  E2E  testing. 

Each  testing  agent  within  DFAS  implements  the  regulation 
within  their  own  construct,  resulting  in  a  non-standard, 
but  successful,  data  collection  and  analysis  process. 
Because  Y2K  E2E  testing  requirements  are  not  system 
centric,  but  business  process  centric,  we  have  hired  JITC 
to  independently  validate  and  verify  our  E2E  planning  and 
testing  efforts.  The  JITC  analysis/evaluation  will 
document  specific  risks  associated  with  data  collection  and 
analysis  procedures,  in  sufficient  time  for  us  to  take 
corrective  action. 

Another  measure  of  risk  mitigation  is  to  conduct  site 
visits,  where  we  meet  with  all  thread  participants.  During 
these  meetings  we  are  emphasizing  the  need  for  adequate 
documentation  of  their  data  collection  and  analysis 
procedures,  as  well  as  documenting  version  control  and 
configuration  management  procedures. 

Transportation  Pay  Event.  Concur.  In  addition  to  the 
Transportation  Pay  System,  DFAS  has  identified  several 
other  systems,  which  claim  completion  of  the  end  to  end 
testing  initiative.  JITC  will  be  used  to  verify  that  these 
systems  indeed  have  met  E2E  requirements.  If  any  system 
fails  to  pass  the  validation  of  JITC,  steps  will  be 
initiated  to  complete  all  or  any  portion  of  the  E2E  process 
that  needs  to  be  completed. 
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Appendix  E.  Report  Distribution 


Office  of  the  Secretary  of  Defense 

Under  Secretary  of  Defense  (Comptroller) 

Deputy  Chief  Financial  Officer 
Deputy  Comptroller  (Program/Budget) 

Assistant  Secretary  of  Defense  (Command,  Control,  Communications,  and  Intelligence) 
Deputy  Chief  Information  Officer  and  Deputy  Assistant  Secretary  of  Defense 
(Chief  Information  Officer,  Policy  and  Implementation) 

Principal  Director  for  Year  2000 
Director,  Defense  Logistics  Studies  Information  Exchange 


Joint  Staff 

Director,  Joint  Staff 


Department  of  the  Army 

Assistant  Secretary  of  the  Army  (Financial  Management  and  Comptroller) 
Chief  Information  Officer,  Department  of  the  Army 
Inspector  General,  Department  of  the  Army 
Auditor  General,  Department  of  the  Army 


Department  of  the  Navy 

Assistant  Secretary  of  the  Navy  (Financial  Management  and  Comptroller) 

Chief  Information  Officer,  Department  of  the  Navy 

Inspector  General,  Department  of  the  Navy 

Auditor  General,  Department  of  the  Navy 

Inspector  General,  Marine  Corps 


Department  of  the  Air  Force 

Assistant  Secretary  of  the  Air  Force  (Financial  Management  and  Comptroller) 
Chief  Information  Officer,  Department  of  the  Air  Force 
Inspector  General,  Department  of  the  Air  Force 
Auditor  General,  Department  of  the  Air  Force 
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Other  Defense  Organizations 

Director,  Defense  Contract  Audit  Agency 
Director,  Defense  Finance  and  Accounting  Service 
Director,  Defense  Information  Systems  Agency 

Inspector  General,  Defense  Information  Systems  Agency 
United  Kingdom  Liaison  Officer,  Defense  Information  Systems  Agency 
Director,  Defense  Logistics  Agency 
Director,  National  Security  Agency 

Inspector  General,  National  Security  Agency 
Inspector  General,  Defense  Intelligence  Agency 
Defense  Systems  Management  College 

Non-Defense  Federal  Organizations 

Office  of  Management  and  Budget 
Office  of  Information  and  Regulatory  Affairs 
General  Accounting  Office 

National  Security  and  International  Affairs  Division 
Technical  Information  Center 

Director,  Defense  Information  and  Financial  Management  Systems, 

Accounting  and  Information  Management  Division 

Congressional  Committees  and  Subcommittees,  Chairman  and 
Ranking  Minority  Member 

Senate  Committee  on  Appropriations 

Senate  Subcommittee  on  Defense,  Committee  on  Appropriations 

Senate  Committee  on  Armed  Services 

Senate  Committee  on  Governmental  Affairs 

Senate  Special  Committee  on  the  Year  2000  Technology  Problem 

House  Committee  on  Appropriations 

House  Subcommittee  on  Defense,  Committee  on  Appropriations 
House  Committee  on  Armed  Services 
House  Committee  on  Government  Reform 

House  Subcommittee  on  Government  Management,  Information,  and  Technology, 
Committee  on  Government  Reform 

House  Subcommittee  on  National  Security,  Veterans  Affairs,  and  International 
Relations,  Committee  on  Government  Reform 
House  Subcommittee  on  Technology,  Committee  on  Science 
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Defense  Finance  and  Accounting  Service 
Comments 


DEFENSE  FINANCE  AND  ACCOUNTING  SERVICE 

1031  JEFFERSON  DAVIS  HIGHWAY 
ARLINGTON,  VA  22240-5291 

SFP  3  0  IS99 


MEMORANDUM  FOR  DIRECTOR,  FINANCE  AND  ACCOUNTING  DIRECTORATE 

OFFICE  OF  THE  INSPECTOR  GENERAL,  DEPARTMENT  OF 
DEFENSE 

SUBJECT:  Draft  of  a  Proposed  Audit  Report  on  Defense  Military  Pay  Year  2000 
End-to-End  Testing  (Project  No.  9FG-9026)  dated  September  3,  1999 


The  Defense  Finance  and  Accounting  Service  response  to  the  Department  of  Defense 
Inspector  General’s  Audit  Report  on  Defense  Military  Pay  Year  2000  End-to-End  Testing  is 
attached. 


/  C.  Vance  Kauzlarich 
Director  for  Information  and  Technology 

Attachment: 

As  stated 


DFAS-HQ/S 
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COMMENTS  ON 
DRAFT  REPORT  OF  AUDIT 
ON  MILITARY  PAY 
YEAR  2000  END-TO-END  TESTING 
PROJECT  NO.  9FG-9026 


DoDIG  Audit  Recommendation 

We  recommend  that  the  Director,  Defense  Finance  and  Accounting  Service 
direct  the  Defense  Finance  and  Accounting  Service  Year  2000  Project  Office  and  the 
functional  proponent  to  take  alternative  measures  to  mitigate  the  risks  of  military  pay 
systems  not  being  able  to  successfully  process  data  after  the  year  2000.  Alternative 
measures  may  include  performing  supplementary  end-to-end  tests,  using  code 
scanners,  or  expanding  the  contingency  plans 

DFAS  Response.  Concur. 

We  concur  with  the  DoDIG  recommendation  and  have  already  undertaken 
alternate  measures  to  further  mitigate  the  risks  of  the  military  pay  systems  not  being 
able  to  successfully  process  data  after  the  year  2000.  All  Defense  Finance  and 
Accounting  Service  military  pay  systems  have  been  certified  compliant  and  the  following 
sures  have  already  been  implemented; 

1  DFAS  has  hired  the  Joint  Interoperability  Test  Command  (JITC)  as  an 
independent  third  party  to  review,  validate,  and  assist  in  documenting 
systems  end-to-end  testing.  The  JITC  visits  have  been  scheduled  for 
October  and  November  Expected  completion  date  of  the  JITC  Independent 
evaluation.  17  November  1999 

2  Additional  contingency  plans  have  been  drafted  and  contingency  testing 
beyond  the  minimum  requirements  wifi  be  conducted.  Expected  completion 
date,  ongoing  through  December. 

3.  An  independent  contractor  has  performed  code  scanning  for  the  Defense 
Joint  Military  Pay  System  (DJMS),  and  the  results  are  being  evaluated  All 
other  military  pay  systems  are  scheduled  to  have  code  scanning  performed. 
Expected  completion  date:  30  November  1999 
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Audit  Team  Members 

The  Finance  and  Accounting  Directorate,  Office  of  the  Assistant  Inspector 
General  for  Auditing,  DoD,  prepared  this  report. 

F.  Jay  Lane 
Salvatore  D.  Guli 
Kimberley  A.  Caprio 
Dennis  L.  Conway 
Eric  L.  Lewis 
Margaret  B.  Bennardo 
Yolanda  C.  Watts 
Susanne  B.  Allen 
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